Triton Inference Server CVE-2026-24208

No special conditions are required for the network attack vector - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of NVIDIA Triton Inference Server with no user interaction needed. Exploitation is limited to availability impact only (A:L); confidentiality and integrity are unaffected (C:N, I:N), meaning an attacker cannot read files or modify data via this path. Scope is unchanged (S:U), containing the impact to the Triton process itself. The primary limiting factor in practice is network exposure: Triton instances deployed behind a firewall, VPN, or authenticated reverse proxy reduce the reachable attacker population despite the no-auth CVSS rating. The wildcard CPE version field means no version of the server is confirmed safe without vendor patch verification.

The CVSS base score of 5.3 (Medium) reflects a modest severity ceiling due to an availability impact rated Low (A:L) with no confidentiality or integrity compromise. However, the attack surface is maximally exposed: the vector is Network (AV:N), complexity is Low (AC:L), no privileges are required (PR:N), and no user interaction is needed (UI:N) - a combination that often underpins mass-exploitation scenarios. The practical risk to ML inference infrastructure is non-trivial: Triton instances frequently serve latency-sensitive production workloads, and even A:L disruption can have cascading effects on dependent services. EPSS probability data was not provided in the available intelligence, preventing quantitative exploitation likelihood assessment. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified, reducing immediate exploitation pressure. The risk posture is best described as moderate-priority patching: the attack requires no preconditions but delivers limited destructive capability.

An unauthenticated remote attacker submits a crafted HTTP or gRPC inference request to a Triton Inference Server endpoint, embedding path traversal sequences (e.g., '../../') within a parameter used in server-side path construction such as a model name or repository path field. The server processes the malformed path without adequate sanitization, reaches an invalid or restricted filesystem location, and enters an error or exception state that causes the inference service to crash or become unresponsive, denying service to legitimate model inference clients. No public proof-of-concept code has been confirmed, but the low-complexity, no-auth attack profile means exploitation attempts are trivially constructable by any attacker familiar with CWE-22 patterns.